FR
live

Linux 7.3 lands Sunday after its release candidates caught a silent data-loss bug

On October 12, 2026, Linus Torvalds released the seventh and likely final release candidate of Linux 7.3, with the stable release expected October 18. This RC cycle surfaced a bug that had been silently dropping writes since Linux 6.6; if you are on an LTS kernel, stay there — 7.3 is not a long-term kernel.

A row of dark hard drives stacked in a bay, one empty slot with its amber warning light lit.

October 12, 2026. Linus Torvalds releases Linux 7.3-rc7, the seventh and likely final candidate before the stable release. October 18, 2026. The final is expected “next weekend,” in Linus’s own words from the announcement. Since Linux 6.6. A bug had been silently dropping writes, and this RC cycle is what caught it. Why it matters: 7.3 is not an LTS kernel, but its test phase has just demonstrated, in concrete terms, why the weekly release-candidate cadence exists — and why nobody should run an RC in production.

A hardware-enablement cycle, not a revolution

7.3 carries no single killer feature. It is a hardware-enablement and virtualization cycle, as the specialized coverage summarizes it: foundations for confidential computing in KVM via the guest_memfd work, smarter thermals on both sides — Intel’s Directed Package Thermal Interrupts now route thermal interrupts to one designated core — and a steady climb of Rust into the driver core, with progress on Nouveau and Nova, the Rust-based NVIDIA driver.

The most symbolic project remains Apple Silicon. Sven Peter’s series bringing initial Thunderbolt and USB4 support to M1, M2 and M3 machines was posted for this cycle, revised mid-flight, but is still under review at rc7: if it does not clear before final, it slides to 7.4. For users, the consequence is simple — XDomain connections and USB3 over USB4 tunnels work in the series, but PCIe and DisplayPort tunneling do not yet. In practice, a user plugging ordinary USB devices into their USB4 ports will be covered once the series lands; anyone relying on an eGPU or a USB4 display must stay on the downstream Asahi stack for another cycle.

On the virtualization side, the work advances in two layers. 7.3 lands the groundwork — the rework of the guest_memfd prepare and invalidate hooks, led by Sean Christopherson — while the full in-place conversion machinery, a 44-patch series carried by Ackerley Tng, sits in the KVM CoCo tree for the 7.4 merge window. For confidential VMs under AMD SEV-SNP and Intel TDX, this is the building block that lets a page flip from private to shared without reallocation, keeping attributes stable across paravirtual I/O paths.

The cycle also carried a small but telling power win: Hector Martin’s apple-pmgr-misc driver lowers fabric and memory-controller power states during s2idle on M1 Pro, Max and Ultra machines, saving roughly one watt — trivial on paper, meaningful over the hours a laptop spends asleep. On the Rust front, 7.3 shipped a new module abstraction, a pin-init rework and error-code completions, while the driver core gained typed I/O regions and serial-bus abstractions. The infrastructure is no longer experimental; each release adds another abstraction layer that new drivers can build on.

Late in the cycle, 7.3-rc7 also carried mount hardening and an AMD errata workaround — the small but consequential fixes that land when a kernel is stabilizing rather than adding features.

The RC that caught a data-loss bug from 2023

This is the story that justifies the release-candidate cadence by itself. The bug, whose offending code landed in July 2023 and shipped in every kernel since Linux 6.6, combined transparent hugepages, cgroup memory limits and memory-reclaim pressure: writes issued after a MADV_FREE could be silently dropped. No error, no crash — lost writes. It hit production users of the Polars analytics library. A one-line fix, merged via the urgent x86 tree just after 7.3-rc3 in mid-September, was marked for stable backports, which carries it down to the 6.6-era LTS kernels.

The same cycle caught a second data-integrity problem: rc3 disabled EROFS’s rolling LZ4 decompression over corruption concerns. Two integrity saves in one cycle — exactly the job the weekly cadence is meant to do, and the reason an RC remains test software.

The “new normal” of AI in the patches

There is a sub-story that Linus named himself. In the 7.3-rc6 announcement in early October, he spoke of a “new normal” of AI, with “half the diff” made up of driver fixes and a meaningful share of small error-path corrections — the kind AI code generation tends to produce, now visible in the diffstat.

The networking subsystem felt it hardest. Jakub Kicinski diverted more than fifty non-urgent fixes to net-next for 7.4 rather than squeeze them into the cycle’s tail, owning it: “you won’t be impressed by the size of this PR, but this is after we shaved off 50 fixes to net-next and asked sub-trees to significantly trim their PRs.” The concrete effect: noisier RC weeks, and non-critical fixes arriving a cycle later.

Know where you stand: three commands

Before you care about what is coming, know what you are running. Two commands do almost all the work, and they behave identically on Ubuntu, Fedora and Arch because they read the kernel’s own interface, not a distro wrapper.

uname -r prints the running version — for example 7.0.0-38-generic on a test Ubuntu 26.04.1 LTS box. cat /proc/version adds the build host, architecture and compiler. cat /etc/os-release identifies the distribution. The comparison to make is simple: line up the uname -r result against the ladder published on kernel.org — the stable line, the mainline line, and the longterm kernels. If your number already matches the stable line, you are current and nothing here requires action today.

Who waits for 7.3, and who does not need it

The calendar is now nearly certain: all seven RCs are out, rc7 landed on October 12 with a six-hour slip that Linus blamed on mixing up days after the Kernel Maintainer Summit and Linux Plumbers Conference, and final is expected October 18 — October 25 only if an rc8 stabilization round appears. Neither is an announced date: it is calendar cadence.

And 7.3 is not an LTS kernel. The longterm list holds only 6.18, 6.12, 6.6, 6.1, 5.15 and 5.10; by the 6.12 and 6.18 precedent, the year-end 7.x release is the LTS candidate. Ubuntu 26.10, “Stonking Stingray,” released October 15, already ships a 7.3 series — its beta ran a 7.3.0-9-generic kernel — and will pick up final fixes through updates. Fedora follows within weeks of final; Arch and CachyOS sooner still.

Verdict

The useful move is not to install 7.3; it is to know where you stand. If you are on an LTS kernel (6.12, 6.6 or older), stay put: 7.3 brings nothing you will not get through backports, and the data-loss bug is already flowing down to those branches. If you are on Ubuntu 26.10, you already have a 7.3 series — let updates carry the final fixes, do not move to a mainline RC. If you follow a rolling release, 7.3 arrives within weeks with no action from you. In every case, run uname -r and compare against the kernel.org ladder: the only bad posture is running an RC — this cycle just proved it can still hide a silent data-loss bug. The weekly candidates exist precisely to catch what ships silently.

References

The cyber brief, every Tuesday

The flaws that matter and the patches to apply, in a ten-minute read.

No spam. One-click unsubscribe.
read next

On the same topic

Nova turns the Linux kernel’s GPU subsystem into Rust’s proving ground

As the Linux 7.4 merge window approaches, the Rust-written NVIDIA Nova driver keeps building out the kernel’s Rust DRM infrastructure. It is a tipping-point signal: the graphics subsystem is becoming the place where Rust earns its stripes in the kernel, one GPU at a time.

Debian bundles 1,313 Linux kernel CVEs into a single Trixie update

Advisory DSA-6528-1, published September 29, 2026, fixes 1,313 CVE identifiers in Linux 6.12.111-1 for Debian 13 Trixie, a volume directly tied to AI-assisted vulnerability discovery in the kernel. A CVE identifier says nothing about severity or exploitability: the job is to update cleanly, not to panic at the number.

← Back to the feed

Type at least two characters.

↑ ↓ navigate ↵ open esc dismiss